CVE-2026-64127

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth L2CAP component within the l2cap ecred reconfigure() function. Due to an incorrect conversion of a request PDU to use DEFINE RAW FLEX(), the l2cap send cmd() function is called with an incorrect size and source pointer. Instead of transmitting the intended request payload, the system copies 8 bytes from the kernel stack starting at the address of a local pointer. This results in the leakage of a kernel stack address to a paired Bluetooth peer. Additionally, the intended fields are not transmitted, causing the peer to reject the request as malformed and breaking the L2CAP ECRED RECONFIGURE feature for the local-side initiator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.